Privacy Policy

This Privacy Policy explains how pdfstork, operated by 3C SEBIRE, a company based in Switzerland, collects, uses, stores and shares personal data when users visit our website, create an account, use our dashboard, use our API, subscribe to our services, or contact us.

pdfstork provides a PDF generation API and related tools for creating and managing PDF templates and generating PDF documents from data submitted by users.

For personal data submitted by customers through the API, pdfstork generally acts as a data processor. The customer remains responsible for the data submitted through the API and for ensuring that they have the required rights and legal basis to process such data. A Data Processing Agreement is available for customers who require one.

1. Data we collect

We may collect and process the following categories of data.

Account and profile data

When users create an account or use the service, we may store:

• email address;
• account identifier;
• name, company, role, industry or company size, if provided;
• authentication and account status data;
• plan, subscription or billing status;
• account settings and dashboard data.

Templates and API data

We store account profile information, user-created templates, and the last 10 API request logs associated with each account. API request logs include the full request payload, including the data submitted for injection into PDF templates. Logs may relate to successful or failed API requests. Older logs are automatically replaced by newer ones. We do not store all generated PDF documents by default.

Usage and technical data

We may collect technical and usage data related to the operation of the service, including:

• API calls;
• rendering activity;
• template usage;
• account activity;
• technical errors;
• timestamps;
• usage volumes;
• service performance data.

We use this data to operate, secure, monitor and improve the service.

Billing data

Payments are processed by Stripe.

We do not store full payment card details on our servers.

We may store billing metadata, such as:

• payment provider customer identifier;
• subscription ID;
• plan;
• billing status;
• invoice references;
• billing country;
• tax-related information, where applicable.

Support and communication data

When users contact us, we may process:

• name;
• email address;
• company;
• message content;
• support history;
• technical information voluntarily shared for troubleshooting.

2. Analytics and advertising

We do not use Google Analytics 4.

We use Umami for privacy-focused analytics, hosted and operated within our own infrastructure. Tracking for analytics and advertising is limited to website usage, product events and conversion events. API payloads, template content and PDF generation data are not transmitted to advertising or analytics platforms.

We may run advertising campaigns on platforms such as Meta, Google Ads, LinkedIn Ads or other advertising platforms.

For campaign measurement and optimisation, we may transmit limited event data to advertising platforms, depending on consent settings and applicable law. This may include:

• page views;
• sign-up events;
• subscription or conversion events;
• campaign and UTM parameters;
• hashed or pseudonymous identifiers, where applicable;
• technical event metadata;
• conversion value and currency, where applicable.

We do not use advertising platforms to process API request payloads, template content or PDF generation data.

3. Purposes of processing

We process personal data for the following purposes:

• providing access to pdfstork;
• managing user accounts and authentication;
• enabling users to create, edit and manage templates;
• processing API requests;
• generating PDF documents;
• logging recent API requests for debugging, support and monitoring;
• managing subscriptions and billing;
• sending transactional emails;
• responding to support requests;
• maintaining service security;
• preventing abuse, fraud or misuse of the API;
• monitoring service performance;
• improving product functionality;
• analysing website and service usage;
• measuring advertising campaign performance;
• complying with legal, tax and accounting obligations.

4. Legal bases

Where the GDPR applies, we rely on the following legal bases:

• performance of a contract, for account creation, service access, API usage, PDF generation, subscriptions, billing and support;
• legitimate interests, for service security, debugging, abuse prevention, fraud detection, product improvement, limited analytics and internal business monitoring;
• legal obligations, for accounting, tax, compliance and regulatory records;
• consent, where required for advertising cookies, conversion tracking, optional tracking technologies or marketing communications.

5. Data retention

We retain personal data only for as long as necessary for the purposes described in this Privacy Policy.

In particular:

• account profile data is retained while the account remains active;
• user-created templates are retained while stored by the user in the account;
• only the last 10 API request logs associated with each account are retained;
• older API request logs are automatically replaced by newer ones;
• billing and invoice records are retained as required by applicable accounting and tax laws;
• support communications are retained as necessary for support history, troubleshooting and legal claims;
• analytics and advertising data are retained according to our configuration and the relevant platform settings.

Users may request deletion of their account and associated data, subject to legal retention obligations.

6. Data sharing

We do not sell personal data.

We only share personal data where necessary to operate pdfstork, process payments through Stripe, comply with legal obligations, or measure advertising campaign performance according to consent settings and applicable law.

API request payloads, template content and PDF generation data are not shared with advertising platforms.

Sub-processors

We rely on a limited number of service providers (sub-processors) to operate pdfstork:

• Stripe — payment processing (United States / global);
• Hetzner — application hosting, database and file storage (Germany, European Union);
• Infomaniak — transactional email delivery (Switzerland);
• Amazon Web Services (AWS) — PDF rendering for the HTML / code editor (United States);
• GitHub — optional account sign-in via OAuth (United States), only for users who choose this sign-in method.

7. Security and international processing

We apply reasonable technical and organisational measures to protect personal data, including access controls, authentication mechanisms, encryption in transit where applicable, restricted internal access, logging and API key protection.

Some service providers may process data outside Switzerland, the European Economic Area or the United Kingdom. In particular, PDF rendering for our HTML / code editor is performed using a service hosted by Amazon Web Services in the United States; the data submitted for that rendering is processed there transiently to produce the PDF. Where required, we rely on appropriate safeguards, such as standard contractual clauses or equivalent legal mechanisms.

Users are responsible for securing their account credentials, API keys and the data they submit through the API.

8. User responsibilities and rights

Users are responsible for the data they submit through pdfstork and must ensure that they have the required rights and legal basis to process and submit such data.

Depending on applicable law, individuals may have rights over their personal data. Privacy-related requests can be sent to hello@pdfstork.com.

We may need to verify the requester’s identity before responding.

9. Cookies and similar technologies

We may use cookies or similar technologies for:

• authentication;
• account sessions;
• security;
• service functionality;
• analytics;
• advertising and conversion tracking.

Essential cookies or storage may be used to provide the service.

Advertising and optional tracking technologies are used according to applicable consent requirements.

Users may manage consent preferences through the cookie banner or consent management tool where available.

10. Automated decision-making

We do not use personal data for automated decisions that produce legal effects concerning users or similarly significantly affect them.

11. Changes to this Privacy Policy

We may update this Privacy Policy from time to time.

The updated version will be published on this page with a revised “Last updated” date.

12. Contact

For privacy-related questions, requests or complaints, contact:

pdfstork / 3C SEBIRE
Switzerland
Email: hello@pdfstork.com

See also our Terms of Service.